REMARKS 

Claims 1-6, 8, 10-16, 18, 20-26, 28, and 30 are rejected under 35 USC 103(a) as 
unpatentable over Ramsey et al. (U.S. Patent No. 7,331,061) in view of Douglas (U.S. Patent No. 
6,269,400), and further in view of Cass. 

Claims 7, 9, 17, 19, 27 and 29 are rejected under 35 USC 103(a) as being unpatentable 
over Ramsey in view of Douglas in view of Cass as applied to claims 1,11, and 21 above and 
further in view of White et al. ("Anatomy of a Commercial-Grade Immune System, IBM 
Research White Paper, 1999"). 

The Ramsey reference teaches three modes: ignore mode and two types of monitor 
modes. In the first mode in the recited claims (inline mode in the specification), data packets are 
not removed from or added to the data stream, but are copied. The feature of copying the data 
packets is not taught in the cited reference. Nor does the reference teach switching to a second 
mode where the data packets are not copies, as recited in claims 1,11, and 21. 

Claims 1,11, and 21 of the present invention recite that statistical results of abnormal 
events as recorded and monitored by a virus monitor are used to detect viruses. This is done in 
the controller. The Ramsey reference does not teach or disclose using statistical results in this 
manner. The Office Action equates virus signatures and intrusion detection signatures as 
statistical results of abnormal events. However, a signature is a unique value, such as a hash 
value, corresponding to the virus. It has no relationship with statistical results of abnormal 
events. 

Claims 1,11, and 21 also recite a virus sensor self-registration module coupled to the 
sensor to automatically self register the sensor. The Office Action cites the Douglas reference, 
which teaches an HTTP server. The cited passage recites: "Thus, if the targeted agent responses 
to the HTTP request and if the agent is not already in the agent registry, an entry is added in the 
agent registry with regard to this particular agent." The recited feature of a self registration 
module is not taught by a generic HTTP server. 
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Applicant believes that all pending claims are allowable and respectfully requests a 
Notice of Allowance for this application from the Examiner. Should the Examiner believe that a 
telephone conference would expedite the prosecution of this application, the undersigned can be 
reached at the telephone number set out below. 

Applicant hereby petitions for an extension of time which may be required to maintain 
the pendency of this case, and any required fee for such extension or any further fee required in 
connection with the filing of this Amendment is to be charged to Deposit Account No. 50-4481 
(Order No. TRNDP010). 

Respectfully submitted, 
BEYER LAW GROUP LLP 

/Rupak Nag/ 
Rupak Nag 
Reg. No. 37,493 



P.O. Box 1687 
Cupertino, CA 95015-1687 
Telephone: (612) 252-3335 
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